[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-forgejo-patches-critical-rce-flaw-in-latest-update":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},6267,"forgejo-patches-critical-rce-flaw-in-latest-update","Forgejo Patches Critical RCE Flaw in Latest Update","Forgejo shipped version 16.0.4 to fix a critical remote code execution bug affecting all releases up to 16.0.3.","Forgejo just patched a critical remote code execution bug. If you run a Forgejo instance, update now.\n\nThe project released version 16.0.4 to fix a critical RCE vulnerability present in all versions up to and including 16.0.3. Forgejo is the open-source, community-run fork of Gitea that powers self-hosted Git forges for developers who want an alternative to GitHub. The release notes are published on Codeberg, Forgejo's own hosting platform, and the fix arrived without the kind of fanfare that usually accompanies feature launches - just a version bump and a fix.\n\nThis matters because self-hosted Git forges sit at the center of a lot of sensitive infrastructure: source code, CI credentials, deployment secrets. A remote code execution flaw in that stack is not a theoretical risk, it is a direct path to a full compromise of whatever an instance touches. Forgejo has positioned itself as the community-governed alternative for teams wary of GitHub's ownership under Microsoft, so a critical bug like this is also a test of how fast that governance model can respond.\n\nThe details of the exploit have not been publicized, and that is normal practice for a fresh patch - give administrators a head start before attackers reverse-engineer the diff. Anyone still running 16.0.3 or earlier should treat that gap as borrowed time, not breathing room.","[\"forgejo\",\"rce\",\"open-source\",\"vulnerability\"]","2026-09-10T15:57:40.000Z","2026-09-10T18:13:31.565Z","2026-09-10T18:13:43.559Z","published",null,[],"security",[26,27,28,29],"forgejo","rce","open-source","vulnerability",[31],{"name":32,"url":33},"Hacker News","https:\u002F\u002Fcodeberg.org\u002Fforgejo\u002Fforgejo\u002Fsrc\u002Fbranch\u002Fforgejo\u002Frelease-notes-published\u002F16.0.4.md",0,{"sections":36},[37,42,45,50,55,60,65,69,74,79,84,89,94,99],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",3480,"2026-09-11T04:00:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":41},"Security",629,{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",336,"2026-09-11T00:56:21.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",153,"2026-09-09T15:12:32.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":41},"Science","science",98,{"name":70,"slug":71,"count":72,"latest_published_at":73},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"General","general",41,"2026-09-08T01:57:23.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]